The present invention relates to a load control backup signal generating circuit for supplying a backup control signal to the switch of the load connected to the output of a control processor operating according to a predetermined program in the case that abnormality occurs in the control processor.
For example, a control micro-processor, i.e., a microcomputer (CPU: central processing unit), operating according to a predetermined program is incorporated in various electric control units (ECUs) mounted on vehicles.
Such a microcomputer usually carries out various controls as intended according to the content of a program prepared beforehand. However, for example, in the case that the microcomputer is affected due to electromagnetic noise entering from the outside, in the case that the microcomputer becomes faulty, or in the case that the microcomputer is affected due to defects (bugs) contained in the program itself, the microcomputer may sometimes cause an unexpected operation and may be brought into a runaway state.
If the microcomputer is brought into such a runaway state, the entire electric control unit falls into an uncontrollable state. Hence, in the systems of such various electric control units, it is necessary to monitor whether abnormality has occurred in the microcomputer, and in the case that the occurrence of abnormality is detected, it is necessary to return the microcomputer to its normal state.
Hence, in such various electric control units, the microcomputer performs control so as to periodically output pulses referred to as a watchdog signal to the outside. Furthermore, a monitoring circuit is connected to the outside of the microcomputer, and this monitoring circuit always monitors the watchdog signal output from the microcomputer. If abnormality occurs in the microcomputer, the watchdog signal does not appear. Upon detecting the state in which the watchdog signal does not appear for a constant time, the monitoring circuit initializes the operation of the microcomputer.
In the on-vehicle electronic control unit according to JP-A-2010-13988, if the main CPU 10 shown in FIG. 1 is brought into a runaway state and the pulse width of a watchdog signal WDS becomes excessively large, a power control circuit 113 detects this state and generates a reset pulse signal RST.
Also in the vehicle-use electronic control system according to JP-A-2011-98593, the watchdog timer 24 incorporated in a power source control IC 23 monitors the operation state of a CPU 1 on the basis of the watchdog signal transmitted from the CPU 1 and transmits a reset signal RST when abnormality occurs.
As described in JP-A-2010-13988 and JP-A-2011-98593, abnormality in the operation of the microcomputer can be detected by monitoring the watchdog signal output from the microcomputer. In addition, upon detecting abnormality, the circuit for monitoring the watchdog signal applies the reset signal to the microcomputer. When the reset signal is applied, the microcomputer initializes the state of the hardware and restarts the execution of the program from the head position thereof as at the time of power supply.
Hence, in the case that the microcomputer is brought into a runaway state due to a temporary factor, such as the entry of electromagnetic noise, the operation of the microcomputer can be returned to its normal state by applying the reset signal.
However, in the case that a continuous failure occurs inside the microcomputer, the operation of the microcomputer cannot be returned to its normal state even if the reset signal is applied. Furthermore, in the case that a failure occurs in the microcomputer provided in an electronic control unit for on/off controlling the energization of a load, the energization of the load cannot be turned on/off even in the case that a circuit for monitoring the watchdog signal is mounted.
Hence, it is desirable that a backup circuit should be mounted on an on-vehicle electronic control unit or the like in preparation for the occurrence of a failure in the microcomputer. In other words, instead of the microcomputer, a circuit for generating a backup control signal for controlling a load is necessary so that the energization of the load can be turned on/off even in the case that the microcomputer is faulty.
Moreover, even in a situation in which the microcomputer is not brought into a runaway state and the program is being executed properly, the function of only a specific output port of the microcomputer may become faulty. Hence, for example, in the case that the control signal for on/off controlling the load is generated using the faulty output port of the microcomputer, a faulty state in which the load cannot be controlled occurs and the state continues even if the watchdog signal is normal.
There is a case in which the on/off duty of load energization is adjusted by using a PWM (pulse width modulation) signal as the control signal for on/off controlling the load. Furthermore, there is a case in which energization is switched on and off using a simple binary signal (high level/low level). Hence, it is not easy to identify whether the output function of the control signal is normal or not.
Moreover, failures that may occur in the microcomputer are classified into failures that occur continuously and failures that occur temporarily. It is desirable that the backup control signal can be used even in the case that a temporary failure occurs in the microcomputer. However, if the backup control signal appears continuously at the time of recovery from the failure, the operation state of the microcomputer cannot be returned to its normal operation state.